Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-09 07:52Z
2026-05-11
2026-05-11 08:16Z
HIGH

CVE-2026-43500 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-43500

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket v CVSSv3.1 7.8 (HIGH) · EPSS 100th percentile

CWECWE 787CWECWE 123TYPVulnerability
7.8
CVSS v3.1
100
Edit Score
2026-05-11
2026-05-11 02:16Z
HIGH

CVE-2026-8260 — The manipulation of the argument AdminPassword results in buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-8260

A vulnerability was found in D-Link DCS-935L up to 1.10.01. The impacted element is the function SetDeviceSettings of the file /web/cgi-bin/hnap/hnap_service of the component HNAP Service. The manipulation of the argument AdminPassword results in buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used. CVSSv3.1 8.8 (HIGH)

CWECWE 120CWECWE 119TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-11
2026-05-11 00:00Z
CRIT

Vibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin America

Trend Micro Research·trendmicro.comin the wild

Trend Micro identified two distinct AI-augmented threat campaigns—SHADOW-AETHER-040 (Spanish-speaking, targeting Latin American governments and financial sectors since late 2025) and SHADOW-AETHER-064 (Portuguese-speaking, targeting Brazilian financial institutions since April 2026)—that use agentic AI (Claude LLM for SHADOW-AETHER-040) to automate the full kill chain from initial access through data exfiltration. Both campaigns deployed custom backdoors (implante_http and SOCKTZ), leveraged ProxyChains/SOCKS5 tunneling via SSH, and used AI agents to dynamically generate attack scripts, reducing signature-based detection. The campaigns share identical tactical patterns (Chisel, Neo-reGeorg, CrackMapExec, Impacket) but appear operationally separate, suggesting AI-assisted attacks are becoming a broader threat actor trend.

SRFApplicationTACTA0004TACTA0005TACTA0001TACTA0002SRFNetworkTACTA0006TACTA0007
92
Edit Score
2026-05-10
2026-05-10 13:16Z
HIGH

CVE-2022-50944 — Aero: CMS 0.0.1 contains a PHP code injection vulnerability that allows authenticated attackers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-50944

Aero CMS 0.0.1 contains a PHP code injection vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious files through the image parameter. Attackers can upload PHP files with embedded code to the admin posts.php endpoint with source=add_post parameter, and the uploaded files are executed by the server. CVSSv3.1 8.8 (HIGH)

CWECWE 94VNDAeroTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-10
2026-05-10 13:16Z
HIGH

CVE-2021-47949 — CyberPanel: 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47949

CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager controller endpoint. Attackers can manipulate the completeStartingPath parameter in POST requests to /filemanager/controller to create symbolic links, read sensitive files like database credentials, and execute arbitrary shell commands through the /websites/fetchFolderDetails endpoin CVSSv3.1 8.8 (HIGH)

CWECWE 59VNDCyberpanelTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-10
2026-05-10 13:16Z
HIGH

CVE-2021-47943 — TextPattern: CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated attackers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47943

TextPattern CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by uploading malicious PHP files through the file upload functionality. Attackers can upload a PHP shell via the Files section in the content area and execute commands by accessing the uploaded file at /textpattern/files/ with GET parameters passed to the system function. CVSSv3.1 8.8 (HIGH)

CWECWE 434VNDTextpatternTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-10
2026-05-10 13:16Z
HIGH

CVE-2021-47941 — WordPress: Plugin Survey & Poll 1.5.7.3 contains an SQL injection vulnerability that allows unauthenticated

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47941

WordPress Plugin Survey & Poll 1.5.7.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the wp_sap cookie parameter. Attackers can craft SQL payloads in the cookie to extract sensitive database information including usernames, passwords, and other confidential data from the WordPress database. CVSSv3.1 8.2 (HIGH)

CWECWE 89VNDWordpressTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-05-10
2026-05-10 13:16Z
CRIT

CVE-2021-47940 — WordPress: Plugin Download From Files version 1.48 and earlier contains an arbitrary file upload

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47940

WordPress Plugin Download From Files version 1.48 and earlier contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting the AJAX fileupload action. Attackers can send POST requests to the admin-ajax.php endpoint with the download_from_files_617_fileupload action, manipulating the allowExt parameter to bypass file type restrictions and upload executable files like PHP shells to the web root. CVSSv3.1 9.8 (CRITICAL)

CWECWE 306VNDWordpressTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-10
2026-05-10 13:16Z
HIGH

CVE-2021-47939 — Evolution: CMS 3.1.6 contains a remote code execution vulnerability that allows authenticated users with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47939

Evolution CMS 3.1.6 contains a remote code execution vulnerability that allows authenticated users with module creation permissions to execute arbitrary system commands by injecting PHP code into module parameters. Attackers can send POST requests to /manager/index.php with malicious PHP code in the 'post' parameter to create modules that execute arbitrary commands when invoked. CVSSv3.1 8.8 (HIGH)

CWECWE 94VNDEvolutionTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-10
2026-05-10 13:16Z
HIGH

CVE-2021-47938 — ImpressCMS: 1.4.2 contains a remote code execution vulnerability in the autotasks administrative interface that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47938

ImpressCMS 1.4.2 contains a remote code execution vulnerability in the autotasks administrative interface that allows authenticated attackers to execute arbitrary PHP code by injecting malicious code into the sat_code parameter. Attackers can authenticate, submit a POST request to /modules/system/admin.php?fct=autotasks&op=mod with crafted sat_code containing PHP commands, which creates an executable file that accepts arbitrary commands via GET parameters. CVSSv3.1 8.8 (HIGH)

CWECWE 94VNDImpresscmsTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-10
2026-05-10 13:16Z
HIGH

CVE-2021-47937 — CMS: e107 CMS 2.3.0 contains a remote code execution vulnerability that allows authenticated users with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47937

e107 CMS 2.3.0 contains a remote code execution vulnerability that allows authenticated users with theme installation permissions to execute arbitrary commands by uploading malicious theme files. Attackers can upload a crafted theme package through the theme.php endpoint that deploys a web shell to the e107_themes directory, then execute system commands via the payload.php script. CVSSv3.1 8.8 (HIGH)

CWECWE 434VNDCmsTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-10
2026-05-10 13:16Z
CRIT

CVE-2021-47936 — OpenCATS: 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47936

OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by uploading malicious PHP files disguised as resume attachments. Attackers can upload PHP payloads through the careers job application endpoint and execute system commands via POST requests to the uploaded file in the upload directory. CVSSv3.1 9.8 (CRITICAL)

CWECWE 306VNDOpencatsTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-10
2026-05-10 13:16Z
HIGH

CVE-2021-47935 — Sentry: 8.2.0 contains a remote code execution vulnerability that allows authenticated superusers to execute

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47935

Sentry 8.2.0 contains a remote code execution vulnerability that allows authenticated superusers to execute arbitrary commands by injecting malicious pickle-serialized objects through the audit log entry data parameter. Attackers can submit crafted POST requests to the admin audit log endpoint with base64-encoded compressed pickle payloads in the data field to achieve code execution with application privileges. CVSSv3.1 8.8 (HIGH)

CWECWE 94VNDSentryTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-10
2026-05-10 13:16Z
CRIT

CVE-2021-47933 — WordPress: MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47933

WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the REST API endpoint. Attackers can upload PHP files with arbitrary names to the config_file endpoint to achieve remote code execution on the server. CVSSv3.1 9.8 (CRITICAL)

CWECWE 306VNDWordpressTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-10
2026-05-10 13:16Z
CRIT

CVE-2021-47932 — WordPress: TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to create

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47932

WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts by submitting crafted requests to the AJAX handler. Attackers can send POST requests to the tcp_register_and_login_ajax action with tcp_role set to administrator to gain full administrative access without authentication. CVSSv3.1 9.8 (CRITICAL)

CWECWE 862VNDWordpressTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-10
2026-05-10 13:16Z
HIGH

CVE-2021-47930 — Balbooa: Joomla Forms Builder 2.0.6 contains an unauthenticated SQL injection vulnerability in the form

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47930

Balbooa Joomla Forms Builder 2.0.6 contains an unauthenticated SQL injection vulnerability in the form submission handler that allows remote attackers to execute arbitrary SQL queries. Attackers can send POST requests to the com_baforms component with malicious JSON payloads in the 'id' field parameter to extract sensitive database information. CVSSv3.1 8.2 (HIGH)

CWECWE 89VNDBalbooaTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-05-10
2026-05-10 13:16Z
HIGH

CVE-2021-47928 — Opencart: TMD Vendor System 3.x contains a blind SQL injection vulnerability that allows unauthenticated

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47928

Opencart TMD Vendor System 3.x contains a blind SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the product_id parameter. Attackers can craft malicious SQL queries using time-based or content-based blind injection techniques to enumerate usernames, emails, and password reset codes from the oc_user table. CVSSv3.1 8.2 (HIGH)

CWECWE 89VNDOpencartTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-05-10
2026-05-10 13:16Z
CRIT

CVE-2021-47923 — OpenCart: 3.0.3.8 contains a session fixation vulnerability that allows attackers to hijack user sessions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47923

OpenCart 3.0.3.8 contains a session fixation vulnerability that allows attackers to hijack user sessions by injecting arbitrary values into the OCSESSID cookie. Attackers can set malicious OCSESSID cookie values that the server accepts and maintains, enabling session takeover and unauthorized access to user accounts. CVSSv3.1 9.8 (CRITICAL)

CWECWE 290VNDOpencartTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-10
2026-05-10 07:16Z
HIGH

CVE-2026-8234 — The manipulation of the argument security_5g leads to stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-8234

A security vulnerability has been detected in EFM ipTIME A8004T 14.18.2. This vulnerability affects the function formWifiBasicSet of the file /goform/WifiBasicSet. The manipulation of the argument security_5g leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.8 (HIGH)

CWECWE 121CWECWE 119TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-10
2026-05-10 06:16Z
CRIT

CVE-2026-6104 — Php Php: This can lead to out-of-bounds read of global memory, potentially causing a crash or

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-6104

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_c CVSSv3.1 9.1 (CRITICAL)

CWECWE 125TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-05-10
2026-05-10 05:16Z
CRIT

CVE-2026-7261 — Php Php: However, in the case SOAP requests results in an error, the persistance is handled

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7261

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclo CVSSv3.1 9.8 (CRITICAL)

CWECWE 416TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-10
2026-05-10 05:16Z
CRIT

CVE-2026-6722 — Php Php: As PHP string allocations can reclaim the freed memory region, an attacker with control

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-6722

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to CVSSv3.1 9.8 (CRITICAL)

CWECWE 416TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-10
2026-05-10 05:16Z
CRIT

CVE-2025-14179 — Php Php: In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.*

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14179

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are CVSSv3.1 9.8 (CRITICAL)

CWECWE 89TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-10
2026-05-10 00:00Z
CRIT

What Is the Instructure Canvas Breach? Impact, Risks, and What Institutions Should Do

Trend Micro Research·trendmicro.comin the wild

In May 2026, threat actor SHADOW-AETHER-015 exposed data from 8,809 Canvas learning management system customers across 50 countries via a backend compromise of parent company Instructure. The breach affects universities, K–12 districts, and medical institutions globally, including all eight Ivy League universities, and exposes sensitive personal information including medical accommodation requests, private advisor conversations, and student disclosures. The primary risk is highly targeted spear-phishing and social engineering campaigns leveraging real institutional context and API integration disruption.

SRFApplicationTACTA0001TACTA0006SRFWebSRFCloudSWCanvasVNDInstructureTYPThreat Intel
78
Edit Score
2026-05-09
2026-05-09 20:16Z
HIGH

CVE-2026-42606 — AzuraCast: Prior to version 0.23.6, the ApplyXForwarded middleware unconditionally trusts the client-supplied X-Forwarded-Host HTTP header

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42606

AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the ApplyXForwarded middleware unconditionally trusts the client-supplied X-Forwarded-Host HTTP header with no trusted proxy allowlist. An unauthenticated attacker can poison the password reset URL sent to any user by injecting this header when triggering the forgot-password flow. When the victim clicks the poisoned link, their reset token is exfiltrated to the attacker's server. The a CVSSv3.1 8.1 (HIGH)

CWECWE 640VNDAzuracastTYPVulnerability
8.1
CVSS v3.1
91
Edit Score